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WHAT IS CLAIMED IS : 

1 1 . An encrypted network system, comprising: 

2 a network to transmit an encrypted packet; and 

3 a computer to receive said encrypted packet from said network, and to 

4 perform a decryption operation thereupon to convert said encrypted packet to a 

5 decrypted packet, said computer including: 

6 a network interface to provide electronic communication between 

7 said computer and said network, 

8 a network driver to regulate said decryption operation, 
Cf a controller to perform said decryption operation, 

10 a host memory to store data that is used or generated by said 

|| decryption operation, and 

iff:] 

P a bus providing electronic communication among said network 

Jl interface, said network driver, said host memory and said controller, said 

14 controller asserting an interrupt prior to a complete transfer of said 

f| decrypted packet from said controller to said host memory. 

1 2. The encrypted network system of claim 1, wherein at least one security 

2 association (SA) is stored in said host memory. 

1 3. The encrypted network system of claim 2, wherein said network driver parses said 

2 encrypted packet, matches said encrypted packet with one of said at least one S A 

3 and instructs said network interface to transfer said encrypted packet and said one 

4 SA across said bus to said controller. 
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The encrypted network system of claim 1, wherein said network interface 
includes a cryptography accelerator. 

The encrypted network system of claim 1, wherein said controller transfers said 
decrypted packet across said bus from said controller to said host memory. 

The encrypted network system of claim 1, wherein said controller asserts an 
additional interrupt after completion of said decryption operation. 

The encrypted network system of claim 1, wherein said network driver specifies 
an average latency value to said controller for use in said decryption operation. 

A computing system for performing a decryption operation on an encrypted 
packet, comprising: 

a network driver to regulate said decryption operation; 

a controller to perform said decryption operation; 

a host memory to store data that is used or generated by said decryption 
operation; and 

a bus providing electronic communication among said network driver, said 
host memory and said controller, said decryption operation converting said 
encrypted packed into a decrypted packet, and said controller asserting an 
interrupt prior to a complete transfer of said decrypted packet from said controller 
to said host memory. 
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The computing system of claim 8, wherein said computer further includes a 
network interface to provide electronic communication between said computer 
and a network. 

The computing system of claim 9, wherein at least one security association (SA) 
is stored in said host memory. 

The encrypted network system of claim 10, wherein said network driver parses 
said encrypted packet, matches said encrypted packet with one of said at least one 
SA and instructs said controller to transfer said encrypted packet and said one SA 
across said bus to said controller. 

The computing system of claim 8, wherein said network interface includes a 
cryptography accelerator. 

The computing system of claim 8, wherein said controller transfers said decrypted 
packet across said bus from said controller to said host memory. 

The computing system of claim 8, wherein said controller asserts an additional 
interrupt after completion of said decryption operation. 

The computing system of claim 8, wherein said network driver specifies an 
average latency value to said controller for use in said decryption operation. 

A method of decrypting an encrypted packet received by a computing system, 
comprising: 

receiving said encrypted packet from a network; 
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converting said encrypted packet to a decrypted packet; 
transferring said decrypted packet to a host memory; and 
asserting an interrupt at a time before completing said transfer of said 
decrypted packet to said host memory. 

The method of claim 16, wherein prior to converting said encrypted packet, said 
method further includes: 

issuing a decryption command to a controller; and 

determining a time for said assertion of said interrupt in response to said 
decryption command. 

The method of claim 16, wherein said step of converting said encrypted packet to 
said decrypted packet further includes: 
parsing said encrypted packet; 

matching said encrypted packet with a corresponding security association 
(SA) stored in said host memory; and 

transferring said encrypted packet and said corresponding SA to a 
controller. 

The method of claim 16, wherein said step of converting said encrypted packet to 
said decrypted packet further includes authenticating said decrypted packet. 

The method of claim 16, further including asserting an additional interrupt upon 
completion of said transfer of said decrypted packet to said host memory. 
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The method of claim 16, further including indicating said decrypted packet to a 
protocol stack after asserting said interrupt. 

A program code storage device, comprising: 

a machine-readable storage medium; and 

machine-readable program code, stored on the machine-readable storage 
medium, the machine-readable program code having instructions to: 

receive said encrypted packet from a network; 

convert said encrypted packet to a decrypted packet; 

transfer said decrypted packet to a host memory; and 

assert an interrupt at a time before completing said transfer of said 
decrypted packet to said host memory. 

The system of claim 22, wherein prior to the instructions to convert said 
encrypted packet, said system further includes instructions to: 

issue a decryption command to a controller; and 

determine a time for said assertion of said interrupt in response to said 
decryption command. 

The system of claim 22, wherein said instructions to convert said encrypted 
packet to said decrypted packet further includes instructions to: 
parse said encrypted packet; 

match said encrypted packet with a corresponding security association 
(SA) stored in said host memory; and 

transfer said encrypted packet and said corresponding SA to a controller. 
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The method of claim 22, wherein said instructions to convert said encrypted 
packet to said decrypted packet further includes instructions to authenticate said 
decrypted packet. 

The system of claim 22, further including instructions to assert an additional 
interrupt upon completion of said transfer of said decrypted packet to said host 
memory. 

The method of claim 22, further including instructions to indicate said decrypted 
packet to a protocol stack after the instruction to assert said interrupt 
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